We begin by recalling the state of the art concerning reactors and provisions for their safety.
The nuclear boiler generally comprises a pressurized water reactor, one or more steam generators, and one or more primary water circulation pumps. Each of the steam generators associated with one or more pumps and with interconnecting pipework constitutes a primary loop.
A closed volume referred to as the "pressurizer" is connected to one of the primary loops and serves, in normal operation, to maintain the primary circuit at a substantially constant pressure, in particular during load transients. The pressure of the primary circuit is maintained either by opening valves for discharging steam or by injecting water by spraying, or else by heating the liquid portion of the pressurizer by means of electrical heater elements which are implanted for that purpose in the bottom thereof. These means are used either to lower or to raise the pressure, depending on boiler operation.
The secondary portions of the steam generators are fed with feed water which is transformed into steam by heat exchange with the water in the primary circuit. This steam then drives a turbine which is mechanically associated with an alternator, thereby feeding an electricity distribution grid.
In the event of a loss of feed water, protection systems issue a reactor emergency stop instruction. This instruction consists in switching off the electricity fed to the devices for holding clusters of control rods. These rods then move fully into the core of the reactor together with the so-called "stop" clusters which are fully extracted in normal operation.
Although it is improbable, account must be taken of the possibility of a reactor emergency stop instruction being issued but not executed, following an abnormal operating transient. This event is known in the art as "an emergency stop failure during a transient". In the event of a loss of feed water flow at the inlet to a steam generator, it is essential to proceed with an emergency stop. However, if the emergency stop does not occur in spite of the instruction which is issued under such circumstances, then the primary circuit is no longer properly cooled. In this case, the temperature of the primary circuit and consequently the pressure of said circuit increase considerably. The pressure may exceed not only the set pressure of the safety valves, but also the test pressure of the primary circuit, even with the safety valves fully open. There is thus a major risk of the primary circuit breaking, i.e., of losing the integrity of one of the three confinement barriers, with the first barrier being the sheath in which the fuel is contained, the second barrier being the primary circuit, and the third barrier being the reactor confinement enclosure.
Various arrangements have been devised to avoid this possibility of primary circuit rupture.
According to French Patent Application No. 2,349,922, auxiliary means issue instructions for inserting certain groups of clusters of rods in the event that the feed water pumps stop, thereby reducing the power of the reactor without having to issue an emergency stop instruction, and thus retaining the possibility of subsequently raising the reactor power as quickly as possible after the feed water pumps have restarted.
According to European Patent No. 0 185 455, means independent of the protection system issue an instruction which is complementary thereto, in the event that the feed water flow rate becomes less than a predetermined threshold value. As a result, if the emergency stop instruction is not issued for some reason, the independent means issue instructions for inserting control rods so as to limit neutron power and thus avoid excess pressure in the primary circuit.
In the French application, the method described serves to reduce reactor power in the event of an incident, thereby avoiding the drawbacks of probable excess pressure and also enabling a rapid return to the desired power level.
In the European application, the method described assumes that emergency stop conditions obtained but that the instruction for the emergency stop is not issued by the protection means. No mention is made of the case in which the instruction is indeed issued by said means, but that the issued instruction is without effect.
In order to avoid excess pressure, proposals have been made elsewhere to greatly increase the discharge capacity of the valves installed on the primary circuit or to increase the capacity of the emergency feed water system.
The drying-out of the steam generators can also be slowed down by stopping the turbine, by partially closing the steam by-pass circuit, and by closing the steam generator purge valves.
These known arrangements give rise to considerable extra cost in boiler construction.
Incidents other than the loss of feed water may require an emergency stop and become dangerous if the corresponding emergency stop instruction is not issued or is not executed. Such a loss and such other incidents therefore constitute incidents of a dangerous kind.